Overview
overview
7Static
static
3Project.P.I.T.T.zip
windows10-2004-x64
1Project.P.I.T.T.zip
windows11-ltsc_2024-x64
1Project.P....!!.txt
windows10-2004-x64
1Project.P....!!.txt
windows11-ltsc_2024-x64
1Project.P....PC.url
windows10-2004-x64
1Project.P....PC.url
windows11-ltsc_2024-x64
1Project.P....up.exe
windows10-2004-x64
7Project.P....up.exe
windows11-ltsc_2024-x64
7Project.P....up.exe
windows10-2004-x64
7Project.P....up.exe
windows11-ltsc_2024-x64
7Project.P....st.exe
windows10-2004-x64
6Project.P....st.exe
windows11-ltsc_2024-x64
6Project.P....64.exe
windows10-2004-x64
4Project.P....64.exe
windows11-ltsc_2024-x64
4Project.P....86.exe
windows10-2004-x64
4Project.P....86.exe
windows11-ltsc_2024-x64
4Project.P....64.exe
windows10-2004-x64
7Project.P....64.exe
windows11-ltsc_2024-x64
7Project.P....86.exe
windows10-2004-x64
7Project.P....86.exe
windows11-ltsc_2024-x64
7Project.P....st.msi
windows10-2004-x64
7Project.P....st.msi
windows11-ltsc_2024-x64
7Project.P....SE.txt
windows10-2004-x64
1Project.P....SE.txt
windows11-ltsc_2024-x64
1Project.P....64.dll
windows10-2004-x64
1Project.P....64.dll
windows11-ltsc_2024-x64
1Project.P....tt.exe
windows10-2004-x64
1Project.P....tt.exe
windows11-ltsc_2024-x64
1Project.P....tt.pck
windows10-2004-x64
3Project.P....tt.pck
windows11-ltsc_2024-x64
3Project.P....64.dll
windows10-2004-x64
1Project.P....64.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
149s - max time network
169s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
21/08/2026, 22:14
Static task
static1
Behavioral task
behavioral1
Sample
Project.P.I.T.T.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Project.P.I.T.T.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
Project.P.I.T.T/HOW TO RUN GAME!!.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Project.P.I.T.T/HOW TO RUN GAME!!.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
Project.P.I.T.T/STEAMUNLOCKED » Free Steam Games Pre-installed for PC.url
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Project.P.I.T.T/STEAMUNLOCKED » Free Steam Games Pre-installed for PC.url
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
Project.P.I.T.T/_Redist/dotNetFx40_Full_setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Project.P.I.T.T/_Redist/dotNetFx40_Full_setup.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
Project.P.I.T.T/_Redist/dxwebsetup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
Project.P.I.T.T/_Redist/dxwebsetup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
Project.P.I.T.T/_Redist/oalinst.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
Project.P.I.T.T/_Redist/oalinst.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
Project.P.I.T.T/_Redist/vcredist_2015-2019_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
Project.P.I.T.T/_Redist/vcredist_2015-2019_x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
Project.P.I.T.T/_Redist/vcredist_2015-2019_x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
Project.P.I.T.T/_Redist/vcredist_2015-2019_x86.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
Project.P.I.T.T/_Redist/vcredist_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
Project.P.I.T.T/_Redist/vcredist_x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
Project.P.I.T.T/_Redist/vcredist_x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
Project.P.I.T.T/_Redist/vcredist_x86.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
Project.P.I.T.T/_Redist/xnafx40_redist.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
Project.P.I.T.T/_Redist/xnafx40_redist.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
Project.P.I.T.T/game/LICENSE.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
Project.P.I.T.T/game/LICENSE.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
Project.P.I.T.T/game/libgodotsteam.windows.template_release.x86_64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
Project.P.I.T.T/game/libgodotsteam.windows.template_release.x86_64.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
Project.P.I.T.T/game/projectpitt.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
Project.P.I.T.T/game/projectpitt.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
Project.P.I.T.T/game/projectpitt.pck
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
Project.P.I.T.T/game/projectpitt.pck
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
Project.P.I.T.T/game/steam_api64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
Project.P.I.T.T/game/steam_api64.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
General
- Target Project.P.I.T.T/_Redist/dxwebsetup.exe
- Size 281KB
- Sample260821-15passdj4x
- SHA256 111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288
- MD5 fd6057b33e15a553ddc5d9873723ce8f
- SHA1 f90efb623b5abea70af63c470daa8674444fb1df
- SHA512 d894630c9a4bdb767e9f16d1b701acbdf011e721768ba0dc7a24e6d82a4d062a7ca253b1b334edba38c06187104351203a92c017838bdd9f13905cde30f7d94d
- SSDEEP 6144:pWK8EGMUjp5cGQ3Mek1B3B9h8Ins3i8AEYBSawz1YSc:JGvjp5cj35kDB9hrs3zARBSaJSc
- TLSH T1F154F11267D9853BE0F56B705DF341236B75BCA15E7AF32E5246A88C0C32784B83A727
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1780 dxwsetup.exe - Loads dropped DLL 2 IoCs
pid Process 1780 dxwsetup.exe 1780 dxwsetup.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" dxwebsetup.exe - Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\directx\websetup\dsetup.dll dxwsetup.exe File opened for modification C:\Windows\SysWOW64\directx\websetup\SETED0C.tmp dxwsetup.exe File created C:\Windows\SysWOW64\directx\websetup\SETED0C.tmp dxwsetup.exe File opened for modification C:\Windows\SysWOW64\directx\websetup\dsetup32.dll dxwsetup.exe File opened for modification C:\Windows\SysWOW64\DirectX\WebSetup dxwsetup.exe File opened for modification C:\Windows\SysWOW64\directx\websetup\SETECDC.tmp dxwsetup.exe File created C:\Windows\SysWOW64\directx\websetup\SETECDC.tmp dxwsetup.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Logs\DirectX.log dxwsetup.exe File opened for modification C:\Windows\security\logs\scecomp.log dxwsetup.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxwebsetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxwsetup.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2888 wrote to memory of 1780 2888 dxwebsetup.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\Project.P.I.T.T\_Redist\dxwebsetup.exe"C:\Users\Admin\AppData\Local\Temp\Project.P.I.T.T\_Redist\dxwebsetup.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1780
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dsetup.dll
- Size 87KB
- SHA256 8f2c455c9271290dcde2f68589cf825f9134beecb7e8b7e2ecbcabeab792280a
- MD5 0a23038ea472ffc938366ef4099d6635
- SHA1 6499d741776dc4a446c22ea11085842155b34176
- SHA512 dcc1c2ea86fd3a7870cd0369fa42f63d493895c546dcdd492ee19079a0d0696d689bbfe7b686d4fa549841896a54e673fc4581b80783d7aa255dfad765b9dc88
- SSDEEP 1536:gtBqvGpPmOEll4RWxiF9G3ZnVdqkFKJuTJbHo0Xm+jN3i97ZTj4FWMD+ZJqsHPCL:gtAvG5mOEll4Roi2pVVFKJuTVtXVpS9y
- TLSH T1E1937D2176A4C176D4D7207875ACA37216BEB5B10BB880CBBB4617E9DC713C1AE3931B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dsetup32.dll
- Size 1.7MB
- SHA256 d7ea3cf1b9b639010005e503877026597a743d1068ae6a453ce77cc202796fea
- MD5 7672509436485121135c2a0e30b9e9ff
- SHA1 f557022a9f42fe1303078093e389f21fb693c959
- SHA512 e46ff68c4a532017f8ab15b1e46565508f6285b72c7a1cbe964ed5e75320c8e14587d01fee61b3966f43636bfe74cebd21f7665b4a726281e771cf9230e69863
- SSDEEP 49152:RjnIXtNeOOOOOOOOOOOOOOOOOiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWI:5IjmY
- TLSH T17B859E31B1D40332EA7203B177118AB7F63EEB9DE119D565B9AE825920C2B9CC37E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
- Size 487KB
- SHA256 d298fd82a39b2385a742ba1992466e081bea0f49e19ece6b2c87c7c262e1fcee
- MD5 eaa6b5ee297982a6a396354814006761
- SHA1 780bf9a61c080a335e8712c5544fcbf9c7bdcd72
- SHA512 ebdc887b6b334b7560f85ab2ebd29dc1f3a2dedac7f70042594f2a9bc128b6fca0a0e7704318ed69b7acf097e962533b3ce07713ef80e8acfe09374c13302999
- SSDEEP 3072:yiqLKTd9mKfwm7rfrK7iPG6rG3C7hO4YTYHVzoPD+sUn7RG+hPXzNbgC1Adm2exP:6kvS4c3C7iMw70
- TLSH T13FB4C05032F4D925F2F32B743AB9E26159BA7E90A938C24D3502525D1BF3B40A96CF37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.inf
- Size 477B
- SHA256 d63c35e9b43eb0f28ffc28f61c9c9a306da9c9de3386770a7eb19faa44dbfc00
- MD5 ad8982eaa02c7ad4d7cdcbc248caa941
- SHA1 4ccd8e038d73a5361d754c7598ed238fc040d16b
- SHA512 5c805d78bafff06c36b5df6286709ddf2d36808280f92e62dc4c285edd9176195a764d5cf0bb000da53ca8bbf66ddd61d852e4259e3113f6529e2d7bdbdd6e28
- TLSH T191F05C5F6D438D0C30A535207AA346CBFF4C107051C5A08EB54DE05A87E87AD49AC0FF
- MD5 SHA1 SHA512 TLSH